News for hackers. Stuff that matters.

A comment on Instructure Pays Ransom to Canvas Hackers. Parent comment

Re:Instructure Pays Ransom to Canvas Hackers by Mezzie on Tuesday May 12, 2026 @03:16PM (#48113048)
Oh, it's insane and I recoiled when she mentioned that.

But it is 100% happening.

People do amazingly stupid things with systems, especially when they don't have enough people with the expertise to set them up properly, so they just throw things in there without stopping to think about whether or not it's a good idea.

[ Parent | on HN ]
Re:Instructure Pays Ransom to Canvas Hackers by SoftTalker on Tuesday May 12, 2026 @03:51PM (#48113517)
So, a particular school system decided to add SSN to the student profile? Or Canvas requires it?
[ Parent | on HN ]
Re:Instructure Pays Ransom to Canvas Hackers by Mezzie on Tuesday May 12, 2026 @04:40PM (#48114220)
It's not required. I don't know precisely what her district is doing or why - I don't work there But she unprompted brought up that a lot of the minors' PII was in there including SSNs.
[ Parent | on HN ]
Re:Instructure Pays Ransom to Canvas Hackers by SoftTalker on Tuesday May 12, 2026 @04:48PM (#48114330)
It would be nice if system owners stopped thinking "we'll just ask for all the info in case we need it" and instead "we might get sued (or ransomed, or both) because we are collecting this."
[ Parent | on HN ]
Re:Instructure Pays Ransom to Canvas Hackers by saghm on Tuesday May 12, 2026 @07:40PM (#48116015)
I'm guessing that Canvas just sort of lets you put in whatever data you want, and someone evidently decided that putting the student's SSNs in there made sense...
[ Parent | on HN ]